Top Open-Source AI Guardrails And Red Teaming Tools In 2027

Commercial AI security platforms are not the only way to protect LLM applications and agents. A strong set of open-source guardrail frameworks, safety classifiers and red-teaming tools now covers most of the basics: catching prompt injection, filtering unsafe outputs, stripping personal data, enforcing tool policies and testing your defenses before attackers do. Many teams start here, and many keep these tools running next to a commercial product.

This list ranks ten open-source AI guardrails and testing tools worth using in 2027, grouped by the job each does best. We checked licenses, maintenance status and ownership as of early November 2026, because this part of the market moves fast: one well-known scanner library has been archived, and one popular framework changed owners this year. If you want a managed product instead, see our list of AI security companies protecting LLMs and AI agents.

Open-Source AI Guardrails And Testing Tools At A Glance

Tool	Maintainer	Job	License
NeMo Guardrails	NVIDIA	Programmable input, dialog and output rails	Apache 2.0
LlamaFirewall	Meta	Guardrails built for agents	Open source, part of PurpleLlama
Agent Governance Toolkit	Microsoft	Policy enforcement on agent actions	MIT
Guardrails AI	Guardrails AI, now owned by Harvey	Output validation and structured responses	Apache 2.0
Llama Guard 4	Meta	Content safety classification	Llama license
gpt-oss-safeguard	OpenAI	Policy-based safety classification	Apache 2.0
Presidio	Microsoft	PII detection and redaction	MIT
Promptfoo	Promptfoo	Evals and red teaming in CI	MIT
garak	NVIDIA	LLM vulnerability scanning	Apache 2.0
PyRIT	Microsoft	Automated red teaming	MIT

Best Open-Source AI Guardrails And Testing Tools In 2027

1. NeMo Guardrails — The Most Complete Programmable Guardrail Framework

NVIDIA’s NeMo Guardrails orchestrates safety around an LLM application. It manages input, dialog, retrieval, execution and output rails using Colang, a purpose-built language for describing allowed conversation flows, and it can call other models, such as Llama Guard, as the classifier behind a rail.

It is the strongest choice for chatbots and assistants that need tight topic control and layered checks. Two things to know: it sends telemetry by default, which you can turn off, and NVIDIA’s packaged microservice versions require an enterprise license, while the toolkit itself is Apache 2.0.

2. LlamaFirewall — Guardrails Designed Specifically For Agents

LlamaFirewall, part of Meta’s PurpleLlama project, is one of the few open frameworks built around agent risks rather than chat safety. It combines Prompt Guard 2 for detecting jailbreaks and injection, AlignmentCheck for auditing an agent’s reasoning for signs it has been hijacked away from the user’s goal, and CodeShield for scanning generated code.

That focus on goal hijacking makes it a natural fit for agents that read untrusted content and then take actions. It works best alongside permission controls, since no classifier catches every attack.

3. Microsoft Agent Governance Toolkit — Deterministic Policy Enforcement On Agent Actions

Microsoft’s Agent Governance Toolkit enforces policy on what agents are allowed to do, using policy-as-code rather than another model’s judgment. It offers SDKs for Python, TypeScript, .NET, Rust and Go and evaluates policies quickly enough to sit in the path of every tool call.

Deterministic rules matter because they cannot be talked out of a decision by a clever prompt. Use it to scope which tools an agent may call, with which arguments, and when a human must approve.

4. Guardrails AI — Validators That Keep LLM Output In Shape

Guardrails AI wraps model calls in a guard made of validators that check, fix or reject responses, and it is widely used to force structured output that matches a schema. A community hub offers ready-made validators for toxicity, PII, competitor mentions and more.

Legal AI company Harvey acquired Guardrails AI in September 2026. The framework remains Apache 2.0 and was still being updated in late October, but Harvey has not said how it will develop the open-source project, and the hosted validator inference service was announced for shutdown. Watch its roadmap before betting heavily on hosted features.

5. Llama Guard 4 — An Open-Weight Content Safety Classifier

Llama Guard 4 is Meta’s open-weight model for classifying prompts and responses against a hazard taxonomy. It can run on a single large GPU and drops into frameworks such as NeMo Guardrails as the safety model for input and output checks.

It is a solid default for content moderation you host yourself. Review its license terms before deploying, since Meta’s Llama license carries conditions that may matter to some organizations.

6. gpt-oss-safeguard — Safety Classification Against Your Own Written Policy

OpenAI’s gpt-oss-safeguard is an open-weight safety model released under Apache 2.0. Instead of a fixed category list, it reads a policy you write in plain language and classifies content against it, explaining its reasoning.

That makes it useful for company-specific rules that off-the-shelf classifiers do not cover, such as what an internal support agent may or may not discuss. Alternatives in the same space include Qwen3Guard from Alibaba.

7. Microsoft Presidio — The Standard Open-Source PII Detector

Presidio detects and redacts personal data such as names, phone numbers, card numbers and health identifiers in text and images. It is commonly placed at the start of an AI pipeline to strip PII before prompts reach a model or a log.

It is not an injection filter, but it closes a different and very common gap: sensitive data flowing into prompts, tools and third-party models.

8. Promptfoo — Evals And Red Teaming That Run In CI

Promptfoo is a widely used open-source tool for testing prompts, models and agents. It runs evaluations and automated red-teaming scans, including injection, jailbreak and data leakage tests, and fits into CI pipelines so regressions are caught before release.

It turns guardrails from a hope into something measured. Run it whenever prompts, models or tools change.

9. garak — A Vulnerability Scanner For Language Models

garak, maintained by NVIDIA, probes language models for weaknesses such as prompt injection, jailbreaks, data leakage and toxic output, much as a network scanner probes servers. It ships with a large library of probes and reports which ones succeeded.

It is best for assessing a model or endpoint before you put guardrails around it, and for checking whether those guardrails actually work.

10. PyRIT — Microsoft’s Framework For Automated Red Teaming

PyRIT, the Python Risk Identification Toolkit, is Microsoft’s open framework for red teaming generative AI. It automates multi-turn attacks, scores responses and helps security teams run repeatable campaigns against models and agents.

It suits teams with dedicated security engineers who want more control than a scanner offers. For outside help, see our list of AI red teaming companies.

How To Choose Open-Source AI Guardrails

Which Layer Are You Protecting?

Inputs, outputs and actions need different tools. Classifiers such as Prompt Guard and Llama Guard screen text, frameworks such as NeMo Guardrails and Guardrails AI orchestrate checks, and policy engines such as Microsoft’s toolkit control what an agent may do. Most production stacks combine one of each.

Is It Actively Maintained?

Check recent releases and ownership. Protect AI’s LLM Guard library, once a common choice, has been archived, and Guardrails AI changed owners in 2026. A guardrail that stops receiving updates quickly falls behind new attacks.

What Does The License Allow?

Apache 2.0 and MIT tools are simple to use commercially. Model licenses such as Meta’s can include extra conditions, so check them with your legal team before deployment.

How Much Latency Can You Afford?

Every classifier call adds time. Use fast, small checks inline and save heavier analysis for high-risk actions or asynchronous review.

How Will You Prove It Works?

Guardrails are only as good as your testing. Pair them with Promptfoo, garak or PyRIT, and read our guide on what prompt injection is to understand what you are defending against.

Conclusion

NeMo Guardrails and LlamaFirewall lead this list as the most capable open-source guardrail frameworks, the first for programmable application rails and the second for agent-specific risks, with Microsoft’s Agent Governance Toolkit adding deterministic control over agent actions. Guardrails AI, Llama Guard 4, gpt-oss-safeguard and Presidio fill in output validation, content safety, custom policies and PII, while Promptfoo, garak and PyRIT make sure the whole stack is tested. No single tool is enough: combine a classifier, a policy layer and continuous testing, and keep checking that each project is still maintained.